How Investigators Track Coldcard Hack Losses and Stolen Bitcoin

Crypto investigators are grappling with one of the toughest loss-allocation problems in digital asset security: estimating theft from self-custody wallets, where there is no authoritative registry of affected users. The ongoing analysis of the Coldcard-related hack is now producing markedly different figures depending on how teams treat “confirmed” victim reports versus on-chain attributions.

Blockchain analytics platform CryptoQuant currently puts confirmed losses at 1,432 Bitcoin, while Galaxy Research and TRM Labs argue the broader toll is higher when tracing suggests additional victims across multiple waves. The discrepancy highlights why hardware-wallet exploits can be hard to quantify—and why investors and security watchers should treat any single number as provisional.

Key takeaways

• CryptoQuant reports 1,432 BTC as a confirmed floor, relying on victim-provided evidence before labeling funds stolen.
• Galaxy Research says it has high-confidence minimum losses of 1,730 BTC, using victim reports to validate wider attack patterns.
• TRM Labs estimates attackers drained roughly 1,816 BTC across 5,200+ addresses in four waves, with the figure expected to keep rising before stabilizing.
• All parties underscore that there is no complete list of affected self-custody accounts, so totals can only be inferred—not definitively counted.

Why Coldcard thefts are difficult to total

Self-custody incidents differ sharply from exchange hacks, where investigators can often begin with a centralized list of compromised accounts or balances. In the Coldcard case, analytics teams instead have to assemble estimates from scattered disclosures—wallet addresses and transaction identifiers shared by victims—then map those to on-chain behavior consistent with the attack.

That structure creates two competing measurement philosophies. One is conservative: count only losses that victims directly confirm, to avoid “false positives” from pattern matching. The other is investigative: use confirmed losses to identify additional wallet clusters and transactions that likely belong to other victims, even when those victims have not yet come forward publicly.

The result is a widening gap between “confirmed” and “attributed” totals—exactly the gap that matters for incident reporting, accountability, and the credibility of downstream security narratives.

Galaxy narrows a moving minimum—backed by victim corroboration

Galaxy’s approach, as explained to Cointelegraph by Alex Thorn, treats early totals as tentative until victim disclosures can corroborate suspected victims and linked on-chain activity. Thorn previously described Galaxy’s earlier estimate—up to 1,816 BTC—as a potential figure rather than a finalized tally.

By Tuesday, Galaxy reported a high-confidence minimum of 1,730 BTC. Thorn also indicated that the minimum could still increase as more victim reports align with the attack’s observed patterns.

In Thorn’s description, the key distinction is between (1) losses directly supported by victim-reported information and (2) additional losses identified through the broader pattern those reports help validate. Galaxy said it has directly confirmed 450+ BTC from victim reports, while those reports have helped uncover other victims in a wider set totaling more than 730 BTC. At the same time, Galaxy said it is still holding back BTC it suspects but cannot yet verify with sufficient corroboration.

For readers, this methodology matters because it suggests a “floor that can rise” dynamic: as the public dataset of victim evidence grows, the subset that analysts can confidently label as theft expands, improving the stability of the totals.

TRM Labs: broader tracing across multiple waves

TRM Labs told Cointelegraph that its independent tracing lands in the same general range as Galaxy. In its more detailed analysis, TRM said its work estimated that attackers drained about 1,816 BTC from more than 5,200 addresses across four waves.

TRM’s Ari Redbord, global head of policy, cautioned that investigators should expect estimates to keep moving upward before settling. That framing aligns with the reality that self-custody victims may take time to discover compromise, identify relevant addresses, and disclose the information needed for analysts to match on-chain traces.

TRM’s results also underline why the same incident can generate different “totals” depending on whether analysts use strict victim confirmations or extend attribution to clusters and transactions that look consistent with the exploit.

CryptoQuant uses victim evidence to avoid inflated claims

CryptoQuant takes a more restrictive stance. According to Cointelegraph, CryptoQuant’s Julio Moreno said the company begins with public reports from victims—including wallet addresses or transaction IDs—then checks those disclosures against known on-chain patterns associated with the Coldcard attack.

With that workflow, CryptoQuant’s current confirmed tally is 1,432 BTC, which Moreno described as a floor that may increase if additional victims publicly reveal the hacked addresses.

Moreno emphasized that CryptoQuant avoids treating on-chain pattern matching alone as a basis for identifying victims, because doing so could produce false positives and inflate the estimate. In his explanation, the fundamental issue is that the stolen Bitcoin belongs to individuals rather than a single centralized entity (like an exchange) that can provide consolidated incident data. As a result, analysts can only confirm what victims disclose.

“Knowing the total BTC stolen is difficult, and it will always be an estimation.”

CryptoQuant’s stance is a reminder that, in self-custody incidents, analytical precision is constrained by data availability. The most cautious number may not reflect the full damage—but it can be the most defensible as “confirmed” while the case is still unfolding.

What others are (and aren’t) tallying

Cointelegraph also reported that Chainalysis has not conducted an independent loss tally. Separately, blockchain investigator ZachXBT publicly stated he has no plans to monitor or trace the incident.

While the absence of a consensus total could frustrate observers seeking a single figure, it also signals that the ecosystem is converging on a shared understanding: without complete victim registries, analysts must balance completeness against verification.

For now, the main thing to watch is whether the announced figures stabilize as more victims submit corroborating wallet data. If disclosures accelerate, the “confirmed” floor should rise and estimates may converge—otherwise the spread between conservative and attributed totals may remain a persistent feature of how self-custody hacks are measured.